Fixed $cookie_ after a cookie without a name

A cookie without a name, such as "a" in "Cookie: a; a=1", was skipped
together with the separator that follows it, so the next cookie was
skipped as well and $cookie_a was not found.  The userid module was
affected in the same way.

User agents send a cookie with an empty name as a bare value (RFC
6265bis, section 5.8.3), so such a token is a valid part of the Cookie
header.

The fix is to not consume the character that fails the "=" check.

The problem appeared in 899b44eab (0.1.29).

diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index 1fa40cc6c3c7fa5b0ec9f33a7a8c6588e3addac6..c69d8ef70f091b92933f1ff02cbd41ec2c918b16 100644 (file)
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -2054,11 +2054,13 @@ ngx_http_parse_multi_header_lines_internal(ngx_http_request_t *r,
                 goto skip;
             }
 
-            if (start == end || *start++ != '=') {
+            if (start == end || *start != '=') {
                 /* the invalid header value */
                 goto skip;
             }
 
+            start++;
+
             while (start < end && *start == ' ') { start++; }
 
             for (last = start; last < end && *last != sep; last++) {